CVE-2024-54262

CVE-2024-54262 Import Export For WooCommerce = 1.5 - Caricamento Arbitrario di File Autenticato Abbonato+ Descrizione Il plugin Import Export For WooCommerce per WordPress è vulnerabile a caricamenti arbitrari di file a causa della mancanza di validazione del tipo di file in tutte le versioni fin...

CVE-2024-43160

Wordpress BerqWP = 1.7.6 - Caricamento Arbitrario di File Non Autenticato CVE-2024-43160 Il plugin BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript per WordPress è vulnerabile a caricamenti arbitrari di file a causa della...

CVE-2024-50510

CVE-2024-50510 AR For Woocommerce = 6.2 – Nicht authentifizierter beliebiger Datei-Upload Beschreibung Das AR for WooCommerce-Plugin für WordPress ist in allen Versionen bis einschließlich 6.2 aufgrund fehlender Dateityp-Validierung anfällig für beliebige Datei-Uploads. Dadurch können nicht...

CVE-2025-48148

CVE-2025-48148 StoreKeeper for WooCommerce = 14.4.4 - Caricamento Arbitrario di File Non Autenticato 🚀 StoreKeeper for WooCommerce = 14.4.4 - Exploit di Caricamento Arbitrario di File Non Autenticato 📝 Descrizione Il plugin StoreKeeper for WooCommerce per WordPress è vulnerabile a caricamenti...

CVE-2024-52380

CVE-2024-52380 Picsmize = 1.0.0 - Caricamento file arbitrario non autenticato Descrizione Il plugin Picsmize per WordPress è vulnerabile al caricamento arbitrario di file a causa della mancata validazione del tipo di file in tutte le versioni fino alla 1.0.0 inclusa. Ciò consente a utenti non...

CVE-2025-5961

🚨 Migration, Backup, Staging – WPvivid Backup & Migration 📈 Esta vulnerabilidade afeta um plugin com mais de700.000+ instalações 📝 Detalhes do CVE CVE: CVE-2025-5961 CVSS: 7.2 Alta Publicado: 3 de julho de 2025 🔍 Descrição O plugin Migration, Backup, Staging – WPvivid Backup & Migration para...

CVE-2025-3054-Exploit

CVE-2025-3054 الاستغلال: تحميل هنا التفاصيل معرف CVE : CVE-2025-3054 نشر : 5 يونيو 2025 CVSS : 8.8 التصحيح متوفر: لا يوجد تصحيح رسمي حتى الآن التأثير إضافة WP User Frontend Pro لـ WordPress معرضة لرفع الملفات بشكل عشوائي بسبب عدم التحقق من نوع الملف في دالة uploadfiles في جميع الإصدارات حتى الإصد...

CVE-2025-4389

CVE-2025-4389 Exploit Dettagli Pubblicato : 16 maggio 2025 Aggiornato : 17 maggio 2025 Gravità : Critico Punteggio CVSS: 9.8 CWE : CWE-434: CWE-434 Caricamento senza restrizioni di file con tipo pericoloso Versioni interessate : Tutte le versioni dalla n/a fino alla 2.6.8.1 Ricercatore :...

EUVD-2026-57082

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-6147

The LightSync Pro WordPress plugin is affected by an insecure file upload vulnerability due to missing file type validation in rest_replace_media() in all versions up to and including 2.1.6. The flaw allows authenticated attackers with Author-level access or higher to upload arbitrary files on th...

CVE-2026-6147 LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

CVE-2026-1771

The MapSVG WordPress plugin is affected up to version 8.14.0. The vulnerability stems from missing file type validation in the SVGFile constructor (due to an incorrect conditional check), allowing authenticated attackers with Administrator+ access to upload arbitrary files via the SVGFile upload ...

CVE-2026-57311

Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other...

CVE-2026-15282

The Instant Appointment plugin for WordPress (affected versions up to 1.2) is vulnerable to arbitrary file uploads due to missing file type validation in the insapp_upload_image_as_attachment function. This allows unauthenticated attackers to upload arbitrary files to the server, with a potential...

CVE-2026-4883 Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetformsajaxformbuilder' function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, a...

EUVD-2026-22830

The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ioimgupload function in all versions up to, and including, 1.2024. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which...

EUVD-2011-5271

Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in processupload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution ...

WordPress plugin Uploadify 代码问题漏洞

WordPress Uploadify plugin is a jQuery-based multi-file upload plugin that allows webmasters or users to implement intuitive and customizable file uploading features on web pages. A code issue vulnerability exists in WordPress Uploadify plugin that stems from a lack of file type validation in...

CVE-2019-25296

The CVE-2019-25296 entry concerns the WP Cost Estimation WordPress plugin up to version 9.642, where missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions allows unauthenticated arbitrary file uploads and deletions. This can enable uploading arbitrary files to the se...

CVE-2025-13094 WP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload

The WP3D Model Import Viewer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handleimportfile function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Author-level access and above, to...